A role is a container object that can be used to package a collection of privileges. Use of the role is then granted to each user that requires those privileges. A role can also be granted to a list of users.

The role must exist before privileges can be granted to it. See CREATE ROLE for the syntax and rules. The role is maintained by granting privileges to it and, when required, revoking privileges from it. When a role is dropped (see DROP ROLE), all users lose the privileges acquired through the role. Any privileges that were granted additionally to an affected user by way of a different grant statement are retained.

A user that is granted a role must supply that role with his login credentials in order to exercise the associated privileges. Any other privileges granted to the user are not affected by logging in with a role.

More than one role can be granted to the same user but logging in with multiple roles simultaneously is not supported.

A role can be granted only to a user.

Firebird has a predefined user named PUBLIC, that represents all users. Privileges for operations on a particular object that are granted to the user PUBLIC can be exercised by any authenticated user.

The non-standard AS clause is supported as a synonym of the GRANTED BY clause to simplify migration from other database systems.

1. SELECT and INSERT privileges to the user ALEX:

   GRANT SELECT, INSERT ON TABLE SALES
     TO USER ALEX;

2. The SELECT privilege to the MANAGER, ENGINEER roles and to the user IVAN:

   GRANT SELECT ON TABLE CUSTOMER
     TO ROLE MANAGER, ROLE ENGINEER, USER IVAN;

3. All privileges to the ADMINISTRATOR role, together with the authority to grant the same privileges to others:

   GRANT ALL ON TABLE CUSTOMER
     TO ROLE ADMINISTRATOR
     WITH GRANT OPTION;

4. The SELECT and REFERENCES privileges on the NAME column to all users and objects:

   GRANT SELECT, REFERENCES (NAME) ON TABLE COUNTRY
   TO PUBLIC;

5. The SELECT privilege being granted to the user IVAN by the user ALEX:

   GRANT SELECT ON TABLE EMPLOYEE
     TO USER IVAN
     GRANTED BY ALEX;

6. Granting the UPDATE privilege on the FIRST_NAME, LAST_NAME columns:

   GRANT UPDATE (FIRST_NAME, LAST_NAME) ON TABLE EMPLOYEE
     TO USER IVAN;

7. Granting the INSERT privilege to the stored procedure ADD_EMP_PROJ:

   GRANT INSERT ON EMPLOYEE_PROJECT
     TO PROCEDURE ADD_EMP_PROJ;

1. Granting the EXECUTE privilege on a stored procedure to a role:

   GRANT EXECUTE ON PROCEDURE ADD_EMP_PROJ
     TO ROLE MANAGER;

2. Granting the EXECUTE privilege on a stored function to a role:

   GRANT EXECUTE ON FUNCTION GET_BEGIN_DATE
     TO ROLE MANAGER;

3. Granting the EXECUTE privilege on a package to user PUBLIC:

   GRANT EXECUTE ON PACKAGE APP_VAR
     TO USER PUBLIC;

4. Granting the EXECUTE privilege on a function to a package:

   GRANT EXECUTE ON FUNCTION GET_BEGIN_DATE
     TO PACKAGE APP_VAR;

1. Granting the USAGE privilege on a sequence to a role:

   GRANT USAGE ON SEQUENCE GEN_AGE
     TO ROLE MANAGER;

2. Granting the USAGE privilege on a sequence to a trigger:

   GRANT USAGE ON SEQUENCE GEN_AGE
     TO TRIGGER TR_AGE_BI;

3. Granting the USAGE privilege on an exception to a package:

   GRANT USAGE ON EXCEPTION
     TO PACKAGE PKG_BILL;

1. Allow user JOE to create tables

   GRANT CREATE TABLE
     TO USER Joe;

2. Allow user JOE to alter any procedure

   GRANT ALTER ANY PROCEDURE
     TO USER Joe;

The optional WITH ADMIN OPTION clause allows the users specified in the user list to grant the role(s) specified to other users.

1. Assigning the DIRECTOR and MANAGER roles to the user IVAN:

   GRANT DIRECTOR, MANAGER
     TO USER IVAN;

2. Assigning the MANAGER role to the user ALEX with the authority to assign this role to other users:

   GRANT MANAGER
     TO USER ALEX WITH ADMIN OPTION;

See alsoREVOKE